The X-XSS-Protection HTTP header is used to prevent XSS.

Is that header directly related to the anti-XSS filter in browser?

During a mission, I found that Chrome & IE blocked a XSS attack but no X-XSS-Protection HTTP header or CSP were present.

Is this normal behaviour?

2 Answers 2


Is that header directly related to the anti-XSS filter in browser?


The idea is that a value of 0 disables the filter, and 1 enables the filter. An additional mode directive may - and should - be used to completely block rendering of a page if an attack is detected.

In practice, not all browsers implement the header that way. Chrome for example does not allow enabling of the filter.

Is [blocking without the header] a normal behaviour?

Yes, current versions of Chrome and IE enable the filter by default.


Yes, it's the same thing. Generally, though, the browser default is "on" - the equivalent of X-XSS-Protection: 1, so failing to include it doesn't make any difference.

You can use it to disable the browser based protections in some cases. This can be useful if you want XSS type payloads to be sent to the server for some reason. Examples of this could include admin pages allowing for the addition of JavaScript content, sites that are used for XSS training exercises, or developers who have made use of techniques which are blocked by browser protections and don't want to rewrite the code.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.